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Abstract 


If computing system performance is degradable then, as recognized in a 
number of recent studies, system evaluation must deal simultaneously with 
aspects of both performance and reliability. One approach is the evaluation of a 
system’s "performability" which, relative to a specified performance veu*iable Y, 
generally requires solution of the probability distribution function of Y. In this 
paper we examine the feasibility of closed-form solutions of performability vdien 
Y is continuous. In particular, we consider the modeling of a degradable 
buffer/miiltiprocessor system whose performance Y is the (normalized) average 
throughput rate realized during a bounded interval of time. Employing an 
approximate decomposition of the model, we show that a closed^orm solution 
can Indeed be obtained. 


I. INTRODUCTION 

In the evaluation of computing systems, issues of performance and reliabil- 
ity have traditionally been distinguished by regarding "performance" as "how 
well the system performs, provided it is correct" (see [l]-[3]. for exaimple) and 
regarding "reliability" as "the probability of performing successfully" (see [4]- 
[7]v for example). Although this distinction is meaningful for hardware and 
software architectures which exhibit "all or nothing" behavior in the presence of 
faUics, it becomes blurred in the context of distributed, multifunction systems 
(computers, computer-communication networks, operating systems, data bases, 
etc.) where performance is "degradable." As recognized in a number of recent 
studies [8]-[l6], tbe evaluation of degradable systems calls for unified 
performance-relial^lty measures which, in the terminology of [12], quantify a 
‘ system’s ’’performability." Such measures, in turn, cedi for appropriate general- 
izations of the types of analytic models and solution methods employed in per- 
formance and reliabihty evaluation. 
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To accommodate these needs, a general modeling framework was Intro- 
duced in [6] (and subsequently refined in [12]) wherein the "performance" of a 
system S over a specified time period T is represented by a random variable Ys 
taking values in a set A. Elements of A are the "accomplishment levels" (perfor- 
mance outcomes) to be distinguished in the evaluation process. With respect to 
Ys. the "performability" of S is the probability measure induced by Ys where, for 
any measurable set B of accomplishment levels (B C A), 

Ps(B) - probability that S performs at 
a level in B. 

(For more precise development of this and related concepts, see [12].) Perfor- 
mabllity evaluation thus entails a complete probabilistic description of the per- 
formance variable Ys. as opposed to partial information such as its expected 
value, its variance, etc. 

Prior work on. the development of specific performability models and solu- 
tions has dealt primarily with discrete performance variables ranging over a 
countable and typically finite set of accomplishment levels (see [11], [14], for 
example). In the overall process of system design and validation, the use of 
these discrete variable methods is best suited to validation of a completed sys- 
tem design with respect to "bottom line" performability requirements. However 
if the evaluation results disclose that a design is deficient, the performability 
data need not be indicative of just how the design should be modified. This is 
due to the fact that lower level, design-oriented details are often suppressed by 
a high level, discrete performance variable. Hence early validation (during the 
design process) at lower system and subsystem levels is required if negative 
results are to indicate how the design should be modified. 

In the latter validation context and, more generally, in the context of 
"design aids," we believe that performability models and solutions can likewise 
play an important role. Here, there is a need to consider more detailed aspects 
of system and subsystem behavior( e.g., speed, responsiveness, etc.) which, 
when modeled as performance variables, can assume a continuum of values. 
Accordingly, the evaluation methods called for here must deal with continuous 
performance variables as well as discrete performance variables. Moreover, to 
support the investigation of various design trade-offs, there is a need to develop 
methods which yield closed-form performability solutions, expressed as a func- 
tion of the underlying model parameters. Some initial results, aimed at fulfilling 


these needs, are established in the presentation that follows. The presentation 
expands on an earlier, more condensed description of this work that appeared in 
[17). 


II. MODEL CONSTRUCTION 


The system we consider is a total system S = (C.E) where, informally, com- 
puter C and environment E can be described as follows. C is a degradable mul- 
tiprocessor system consisting of N identical processors (N 1) and a buffer 
(queue) for temporary storage of incoming tasks (see Fig. 1). The buffer B is 
assumed to have a finite capacity L (L ^ 0), that is, B is capable of storing at 
most L tasks. Note that, by allowing N = 1, we are including the degenerate case 
of a (nondegradable) uniprocessor system. Similarly, by allowing L - 0, we are 
including the ease where C actually has no buffer at all. The environment E is 
the arrival of computational tasks at the input to the computer. We assume 
here that tasks arrive randomly (one at a time) and that there is no upper ^ 
bound on the total number of arrivals. More detailed descriptions of C and E will 
be supplied momentarily. 


Purformanca Variable 


Regarding performance, we presume that, ideally, the user wants the com- 
puter to process all tasks that arrive during some specified utilization period T. 
However, due to the finite capacity of the buffer and to faults which may occur 
in the buffer and processors, ideal behavior will generally not be attainable. 
Accordingly, an interesting measure of performance in this context is the frac- 
tion of task arrivals that C in fact processes during utilization. To define this 
more precisely, if t e [0,«). let At = number of tasks that arrive during [0,t] 
and let Ot = number of tasks that are processed during [0,t]. Then, relative to 
the utilization period T ~ [0,t], we take the performance of S to be the random 
variable 



fraction of arrived tasks processed during T. 


( 1 ) 


Alternatively, if we let 
A* 

at = Y - average arrival rate during [0, t] 



( 3 ) 


dt = ~ s average throughput rate of S during [O.t] 

■ V 

then 

Y - 5 i - ^ ^ 

*" Ai “ At/t " ai 

_ average throughput rate of S during T 
average arrival rate during T 

In other words, the performance of S can also be interpreted as the "normalized 
average throughput rate,” normalized with respect to the average arrival rate 
and averaged over the utilization period T = [0,t]. 

To solve the probability distribution function of Ys and, hence, the perfor- 
mability of S, the specific nature of the computer C and environment E must be 
speUed out in more detail. We begin with the environment. 

Environment Model 

If, as above, we let At denote the number of task arrivals during the interval 
[0,t], the environment E can be regarded as a stochastic process 
I^s^Ailt e [0,»)i where the variables At take values in the state set 
Qs s (0,1,2,... {. To designate the specific nature ofl^, we suppose further that 
arrivals are "purely random" in the sense that interarrival times are indepen- 
dent random variables with identical exponential distributions. This is 
equivalent to sa)ring that the arrival process is a Poisson process. Accord- 
ingly if we let 

o = average arrival rate (in the long run), (6) 

tliiat is, a = llmat (see (2)), then Xc is uniquely determined by a. 

i-e«a 

Cbmputer Model 

As depicted in Fig. 1, the fault-free structure of the computer is determined 
by values of two basic parameters; 

N = number of processors (W >: 1) (6) 

L = storage capacity of the buffer (L at 0). (7) 

To describe how the system is altered by faults, we assume the following. If C is 
teult-free (i.e;, resources B, Pi. Pt.-.-. Pn acb fault-free) then all processors are 
active (no "stand-bys") and are able to process tasks concurrently. Each pro- 


s 


eesstdr Is selMesting and, in the presence of a single faulty processor, the sys> 
tern is able to recover (with a specified "coverage") to an (N’l)-processor 
configuration, provided N % 2. In this configuration, C behaves the same as a 
fault-free version of the system with N-1 processors (provided (N-1) % 2). When 
only a single processor remains fault-free, fault recovery is no longer possible. 
The input buffer B is assumed to be nondegradable, l.e., it either performs 
correctly or falls. (In a more general example, the buffer could likewise be 
treated as a degradable resource.) Either failure to recover from a processor 
fault or failure of the buffer results In a total loss of processing capability (sys- 
tem failure). 

Under the above assumptions, the relevant structural configurations of C 
can be represented by the state set Qg = 10,1, ....Nf where state 1 is Interpreted 
as follows: 


1 : fault-free buffer and 1 fault- 
free processors (l£usN) 

0 : system failure 

Modeling how structure varies (probabilistically) as a function oi! time thus 
reduces to a standard problem encountered in reliability modeling. In this 
regard, let us assume that resources fall (become faulty) at constant rates equal 
to their respective long run average failure rates. More specifically, for each of 
the processors, let 

Ap = processor failure rate (8) 

and let Cp denote the coverage referred to above, l.e., 

Cp = probability of recovering from 

a processor fault. ' ' 

For the buffer B with capacity L, we assume that B Is constructed from L 
"stages" (a stage can store a single task) where, for each stage, 

Xb = buffer stage failure rate. (10) 

Then, if stages fail Independently and any stage failure results in a buffer fsdlure. 
It follows that 

Xb - buffer failure rate = LXb. (11) 

Finally, if we suppose that resource failures are Independent and permanent 


(i.e.. there is no "repair”) then the structure of C can be modeled as the Markov 
process Xr of Fig. 2 , where the state set of Xr is Qr. 

Tue parameters Ai(l ^ i ^ N) and C|(2 ^ i :£ N) of Fig. 2 are formulated as 
follows in terms of the basic parameters defined above. The transition rate X| 
from structure state i is just the accumulated failure rate of fault-free 
resources associated with state i. that is, 

X| = iAp + Xr — iXp + LXr . (12) 

The combined "coverage" Cj in state i (when interpreted directly in terms of Fig. 
2) is the probability of a transition to state i-1 given a transition from state i. In 
terms of resource faults, Cj is therefore the probability that a transition from 
state i is caused by a processor fault and, in turn, C is able to recover firom that 
fault via self-test and reconfiguration. As the latter is specified by the coverage 
parameter cp (9), it follows, via a simple conditional probability argument, that 

iXpCp Cp 

iXp + LAr LXb * ( 13) 

iXp 

For each structure state i e Qr, we now proceed to construct a submodel 
of C that accounts for the internal state behavior of C when its structure is fixed 
at i. Suppose, first, that all resources are fault-free (i=N). Then when the buffer 
is empty and at least one processor is idle, processing of an incoming task is 
immediately undertaken by an idle processor. If all processors are busy, an 
incoming task is stored in buffer B, provided B is not "full" (i.e., the number of 
tasks stored in B is less than L); as soon as one of the processors becomes idle, 
it begins to process the task that was least recently stored in the buffer. 
Finally, if B is full when a task arrives, the task is rejected (lost) and hence not 
processed at all. When only i processors are fault-free (structure state i, 
0<i<N), the system behaves as described above if each occurrence of the word 
"processor" is replaced by "fault-free processor." Upon failuure of the system 
(state 0), processing ceases and any incoming task is rejected. 

On closer inspection and in queueing theoretic terms (see [16], [19], for 
example), structure state i (1 ^ i ^ N) can be viewed as a queueing system with i 
servers (the fault-free processors), a finite queue of size L (the buffer), and a 
first-come-first-served queueing discipline. If, further, we assume that the pro- 
cessing times for each fault-firee processor are independent and exponentially 


d^tributed with parameter 

s average processing rate (in the long run), (14) 

then structure state i is an H/M/i/i-t-L queueing system. With this identification, 
a submodel of C in structure state i follows immediately by taking the internal 
states to be the set Qi,i = Ul 0 ^ j ^ i-i-L) where j - number of tasks in C. Letting 
3^ denote the submodel in question, that is, the stochastic representation of an 
H/M/i/i+L queue with state set Qij, it follows that Xy is the "birth>death" Markov 
process given by the state-transitiomrate diagram of Fig. 3. (In case isQ, we 
take Xi,o to be a degenerate process consisting of a single absorbing state j-0.) 
The model parameters indicated in Fig. 3 are the task arrival rate a (2) associ- 
ated with the environment X^. the processing rate /i (14) of each processor, and 
the capacity L (7) of the buffer. 

Composing the internal state submodels 3Q,( (Fig. 3) with the structure 
model Xb (Fig. 2), C can be modeled as a single Markov process Xc with state set 
Qe ~ KlJ)U ^ Qr> J ^ Q 14 ) where, as defined above, i is the structure state of C 
and j is the number of tasks in C. The state-transition-rate diagram of the com- 
posite model Xc is shown in Fig. 4. For a structure state i such that 2 sc i ^ N, the 
transition to state (0,0) indicated at the far left of the diagram applies to each 
state (i,j) in the corresponding row of the diagram. Xc. together with the 
environment model X|, thus constitute the base model of the system S s (C,E). 
However, with respect to the performance variable Ys (see (1), (4)) we find that 
the relevant aspects of Xg have been incorporated in Xc. so that Xc can serve as 
the base model of S. i.e., Xg^Xc- 

As a base model. Xc is similar in both its purpose and its appearance (Fig. 4) 
to the kind of "workload models" considered by Gay and Ketelsen [10]. One 
difference is that we make no assignment of "capacities" to the states of the 
model. Rather, the computational capacity of a given structural configuration is 
Implied by certain transition rates, i.e., in structure state i, the maximum pro- 
cessing rate is i/i tasks/unit time. The major difference, however, is that the 
qrstems considered in [10] are repairable, resulting in irreducible Harkov 
models where all states are recurrent non-null. The model of Fig. 4, on the other 
hand, has transient (non-recurrent) states; indeed, all the states of Xc are tran- 
sient except for the absorbing state (0,0). This difference has a considerable 
impact on techniques that can be used to solve the model, as we discuss in the 


■eetion that follows. 


III. MODEL SOLUTION 

Since the performance variable Ys (see (1).(4)) is continuous, a solution of 
performability requires solution of the probability distribution function (PDF) of 
Ys. To this end and to simplify notation, let Y denote Ys and let Fy denote the 
PDF of Y, that is, Fy(y) = Prob[Y ^ y]. Then, ideally, we would like to solve Fy as 
an exact formulation of Fy(y), expressed in terms of y, t (the duration of utiliza- 
tion), and the parameters of the base model Xs - Xc (Fig. 4). The parameters 
involved, including those derived from basic parameters, are summarized in 
Table 1. Such a formulation, however, would require (among other things) an 
exact, time-dependent solution of the state probabilities of the base model. 
Although this is possible, in principle, it is fraught with practiced difficulties. 
Indeed, for even the simplest models of this sort, e.g., an M/M/1 queue, such a 
solution is far from trivial (see [16], pp. 73-78). On the other hand, if we are wil- 
ling to settle for a good approximate solution, many of these difficulties may be 
circumvented. 

Adopting the latter strategy, let us siq>pose the system is such that the util- 

# 

ization time and the average failure times of the resources are much larger than 
the average interarrival time of incoming tasks and the average processing time 
of a processor, i.e., 

t, 1/Xp, 1/Xb» 1/a, 1//*. (16) 

Note that this situation will prevail in most computing system applications since 
the qumtities on the left are usually multiples of hours while those on the right 
are typically fractions of seconds. For example, if t s lo hours and 1/a s i 

Second then s 36,000. Assuming (15) (as we do throughout the remainder 

1/Ot 

of the discussion), from the formulation of X| (see (12)), it follows that 
t, 1/X| » 1/a, 1/^t. 

Accordingly, for each structure state i (l5£b>N) let 

Wt~total time spent in state i during [0,t] (16) 

and suppose that the system enters state i during utilization, i.e., > 0. Then, 

With high probabiEty, » 1/a, l//i. In other words, the time spent in a struc- 
ture state (if entered) is likely to be long compared to the intertransition times 


among the internal states of that structure (see Fig. 4). 

Thus, to a good first approximation, the internal state behavior in structure 
state i can be viewed as the long run, equilibrium behavior of the process ^ 
(Fig.. 3). More precisely, if we let Si denote an M/M/i/i<fL queueing system (the 
system modeled by Xjj) and we let 

ri = normalized average throughput rate 
of Si (in equilibruim) 

then ri is the rate at which i contributes to the performance of S. Moreover, 
accounting for the fact that ro= 0 , one can easily verity that 



where, by (16), -7 is just the fraction of the period [ 0 ,t] that the system is in 

V 

structure state i. 

Mathematically, the performance variable Y is now expressed as a function 
of lower level variables ri and (las i ^ N). By their definitions, each variable ri 
can be solved in terms of the equilibrium behavior of its corresponding queueing 
model Xy. As is well known (see [16], [19], for example), the equilibrium distri- 
bution of each ri is deterministic (i.e., ri assumes a constant value with probabil- 
ity 1 ) whence Y reduces to a linear combination of the (dependent) variables 

Wt^ yft V^. Accordingly, the first step is to obtain closed-form solutions of the 

equilibrium rates ri, r 2 rn. 

Equilibrium Solutions 

As above, let Si denote an M/M/i/K queue, with Ksi4-L, and let px denote the 
equilibrium probability of finding Si in state K (full queue). Then it is known (see 
[19], for example) that the average arrival rate (in equilibrium) of tasks that 
actually enter the system is a(l-piO- Since this coincides vdth the average 
throughput rate of Si (in equilibrium), on normalizing by the arrival rate a we 
conclude that 

ri = l-pK. (19) 

The general solution of px is known (see [19], Appendix C, Table B, for exam- 
ple) and can be expressed ats a function of i and the model parameters L=K— i, a 
and /Li. Moreover, the dependence on d and fj. is only through their ratio 


M 


( 20 ) 


the so-called "traffic intensity." By (19), these remarks apply as well to ri which, 

in a general form, can be expressed as follows; 

1 


if uKi 


ri = 



1-^ 
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L+i 


1 

n*o n! i! 
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i! 

i 
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1 

n*0 n! i! 
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^i ^ 


L+J+l 


( 21 ) 


^4 

L - 1 

nso n! i! 



E L 

n=0 n! i! 


if u=i 


From these expressions it follows that, for fixed L, the normalized average 
throughput rate rj is a monotonically decreasing function of u where, in the 
limit, r|-»0 as u-**. On the other hand, for fixed u. rj is a monotonically increas- 
ing function of the buffer capacity L, as one would expect, since the larger the 
buffer, the less chance there is of losing a task. Although we could examine the 
functional properties of ri in greater detail, they are well understood (by people 
familiar with queueing systems) and, for the purpose of the development that 
follows, the above observations should suffice. 


Solution of Performability 

Since the variables rj assume constant values for fixed values of the base 
model parameters, by (IB) the performance variable Y can be expressed as a 
linear combination of lower level random variables, viz. 

( 22 ) 

where W| (16) is the total time spent in structure state i during [0,t]. Moreover, 
as the variables Wi depend only on the structure model 3^ (Fig. 2), Xr can serve 
as the base model for the remaining part of the solution process. Accordingly, if 
equation (22) is extended to include state i = 0 where, trivially, Tq = 0 (see (17)), 
the equilibrium solutions ro, ri, . . . , may be thought of as "yield rates" 


assigned to states 0, 1 N, respectively. In other words, the rj constitute a 

"reward structure" (see [20]) for the Markov process Xr. To the best of our 
Imowledge. however, the analysis of reward models has dealt exclusively with the 
solution of expected rewards, e.g., for the variable In question, the expected 
vcdue E[Y] of Y. Performabllity evaluation, on the other hand, requires a com- 
plete probabilistic description of Y, as provided by its PDF Fy. 

At this point, however, we find that a probabilistic characterization is 
difficult to obtain since the random variables Yfx, W^, * ■ * , are (statistically) 
dependent. This Is due to the fact that the combined times spent In states 

1, 2 N cannot exceed t. Thus, for example, Prob[Wt^“^ > 0IW{* = t] = 0 

whereas Prob[W{*"‘ > 0| 0 < Wt** < t] = cr (see (13)). thereby demonstrating the 
dependence between Ifi and In general, whenever performance is defined 

with respect to a bounded utilization period, such dependencies are likely to 
exist among variables that are closely related to the performance variable. 

To circumvent this dlfilculty, a possible approach (which. In retrospect, 
appears to be the key to solving such problems) Is to search for a lower level 
model which, at the expense of a more complex relation to Y, has a simpler pro- 
babilistic description. For the situation In question, we obtain such a model by 
considering the times spent In structure states 1. 2,..., N over the entire 
unbounded Interval [0,»). More precisely, we take the lower level model to be 
the sequence of variables V = (V|, Va, , Vr) where 

V| ” Ito = time spent in 

state 1 during [0,“). 

Although this model Is no less "abstract” than that described by the sequence 
(Wt*,W^.....W^), It should be clear that It contains more Information, thereby per- 
mitting Y to be formulated as function y of Y. To establish the specific nature of 
y (referred to in [12] as a "capability function"), let v s (vi,vg,...,VR) denote a 
value of V and, for notational convenience, let Cj denote the sum 

nj = fjv| : 

i-J 

Then it is relatively easy to verify that 


12 


&F.1 


7(v) = 


if a, St 
7 S (ri “ rj)v, 

^ i«j+i 


*•] + 


fN 


■J+l 

if (Tn > t 


r| if 0]^| s t, <7j > t 


(24) 


At the cost of a more complicated capability function, we are now at a level 
where a probabilistic characterization is easier to obtain. This, in turn, can pro- 
vide the solution we seek, since Y - y(V) and hence Fy(y)sProb[ 7 (V)sy]. Conse- 
quently, if we let BjS^b | bsy) then 

Fv(y) = Prob [Vey-HBy)]. (25) 

To formulate these probabilities, we note first that, over the unbounded period 
[0,«»), a state trajectory (sample path) of 5^ (see Fig. 2) wiU, with probability 1. 
pass through a finite sequence of distinct states, beginning in some initial state 
Ic and terminating in the absorbing state 0. For each state i > 0 that is visited, 
the variable Vj is thus the time of a single ‘'sojoum" is state i. Moreover, since Xjt 
is a Markov process, it is known (see [21], for example) that these sojourn times 
are exponentially distributed and are conditionally independent, given the 
sequence of states that are visited. 

With these observations, the solution qf Fy can be conveniently decomposed 
by considering the conditioned PDF of Y with respect to the random variable 

U = sequence of states (excluding 0) visited during [0.«>). 

More specificedly, by the transition structure of Xs, if a trajectory begins in state 
k where k > 0 and ends in state £ (prior to entering state 0) then £ ^ k and 

U = (k,k-l £). 

If a trajectory begins in state 0 then no states (other than 0) are visited during 
[0,a*), in which case 

U = A (the null sequence). 

Thus, for an N-processor system, there are + 1 possible values of U. 

Accordingly, if we let u denote a value of U and let 
Fy|o * conditional PDF of Y given U=u 
then Fy(y) may be expressed as 




FrCy) = Sl^r|u(y|u)Prob[U=u] (28) 

u 

where the sum is taken over all possible values of U. Moreover, for a given u. the 
terms Fv|u(y I u) Prob [U = u] can be solved as follows. 

Regarding FY|u(y |u), if we let Cy=7“*(By) then, in view of (85). when Y is con- 
ditioned by U=u we have 

Fyiu(ylu) = Prob[V e Cy|U = u]. 

This says, in turn, that Fy|u(y | u) can be solved by integrating the conditional 
joint probability density function (pdf) of V given U s u over the region Cy. More 
precisely, if we let 

fviu - conditional joint pdf of V given U=u 

then 

Fy|u(y iu) = f f ^V|u(v|u) dv, dvg • dvN . (87) 


The formulation of fv|u(v|n) is straightforward, due to the independence of 
the sojourn times Vi corresponding to states in the sequence u. Given u. for 
each state i e u (meaning, with a slight abuse of notation, that i appears in the 
sequence u), we know that Vi is exponentially distributed with parameter Xi (see 
(18) and Fig. 2); if u£u then, with probability 1. V| s 0. Consequently, by the 
independence of the Vi, if u is nonnull then 


if Vj = 0, for all j u 

iCu 


fv|u(vi u) s 


0 if V] > 0, for some j £ u. 


In case u = A (the null sequence) the formulation is trivial, i.e.. 


( 88 ) 


fv|u(v|A) = 


1 if v,=V2= • • • =vj|=0 
0 otherwise. 


(89) 


Determining the multiple integral of equation (87), on the other hand, is gen- 
erally quite difficult, due to the nonlinear form of the capability function y (see 
(84)). Details of this process are illustrated, for the case N s 8, in the section 
that follows. 


As for the second product term in equation (26), the solution of Prob[U - u] 
is immediate by inspection of the transition-rate diagram of (Fig. 2). Given a 
state sequence u, u may be viewed a trajectory of the "imbedded" discrete-time 
Markov process X obtained by sampling Xg, each time it chamges state. More- 
over, by inspection of Xr, if i ^ 2, then Prob[^«.i = i— 1 15^ = i] = Cj (see (13)) and 
Prob(3t+i = 0|3^ = i] = 1 - ci; if i = 1. Prob[3^+i = 0|Xn = 1] = 1- Accordingly, if 
we let tpi |0 < i ^ Nj denote the initial state probability distribution of Xg, i.e., 

pi - Prob[XR,o “ i] 

then, for a nonnuU sequence u = (k,k-l 1) 


Prob[U = u] s 


PscCkCk-i • * ci+id - C|) if k > I ^ 2 

PkCicCk-i ■ ’ Cz if k > £ s 1 
Pk(l *-Ck) ifk = £^2 
Pi if k = £ = 1 . 


(30) 


In case u is the null sequence, the corresponding trajectory must initially be in 
state 0; hence 

Prob[U = A] = po. (31) 


This completes the description of the solution procedure which, in sum- 
mary, involves the following steps: 


1) For each structure state i, apply (21) to determine the equilibrium solution 
ri of the normalized average throughput rate in state i. 

2) For each state sequence u, apply (26), (29) to determine the conditional 
joint pdf of V given U s u and then apply (27) to determine the PDF of Y 
given U s u. 

3) For each state sequence u, apply (30). (31) to determine the probability 
that U = u. 

4) Combining the results of 2) and 3), apply (26) to determine the PDF Fy of 
the performance variable Y. 

Dual-processor £!xam.ple 

To illustrate this procedure and, particularly, the kind of solutions it is 
capable of producing, let us consider the case of a buffered dual-processor 


St9p 1) 

On substituting the values i^l end 1^2, respectively, in the general equili* 
brium solution (21) and after appropriate simpUfleations. rt and rg have the fol* 
lowing solutions: 




rs = 


Stapej 

When N = 2, there are four state sequences to consider: Ui s (2,1), U( = (2), 
Ua ~ (1). and u« = A. Interpreting these sequences, if a state trajectory (of Xr) 
has sequence U) then the system is initially fault-free and, during [ 0 ,»), recovers 
from a single processor fault before eventually failing. If the sequence is Ug, the 
system is initially fault-free but fails on the first occurrence of a processor or 
buffer fault. Ug says that one processor is initially faulty; U 4 says that the sys- 
tem failed prior to utilization. Applying Step 2) with respect to sequence U| (the 
remaining cases are simpler and we omit their illustration), by (28) we have 

fv|o(v| «i) = X|e"^‘''‘Ate"^^* . 


1 - 

1 - u**** 
L +1 


if u 1 


L't '2 


if u=l 


1 + I - 8(f )*'** 


2L» 3 
2L-H 5 


(32) 


itu I* 2 


( 33 ) 


ifus2 . 


To subsequently obtain its integral (see (27)) over the region Cj = (vl 7 (v) < yf. it 
is necessary to characterize Cy for various ranges of y so as to determine the 
specific limits of integration. This is done by specializing 7 (24) to the case in 
point (N - 2) and examining the boundary 7 ~'(y) that delimits the region C,. 
Thus, for example, if y is in the range ri < y < rg, then Cy is the region of the Vi- 
Vf plane depicted in Fig. 5. For convenience in stating the resulting solution, let 
i/| denote the quantity 



( 34 ) 






&K.1 


16 


Note that when Xf (12) and ri (32). (33) are fully expressed, i/j is a function of 1 
and the base model parameters Xp. X^. L, a, and /x (am Table 1). Then, for the 
instance where y is in the range ri ss y < rz. integraHon over Cj (see Fig. 5) yields 
the solution 


^rio(y|u|) s 1 - 


^ e e 




Solutions with respect to other ranges of y and other values of U are obtained in 
a like manner. 

St»p3) 

By the definitions of Ui. . . . . u« and on applying (30). (31). we have 
I^b(U = U|] = paCa . 

Prob[U = ue] = Pa(l - ca) . 

Prob[U = us3 = Pi . 


Prob[U = U4J w Pb = 1 - (p, + Pa) . 


Stap 4) 

Applying equation (26) to the results obtained in steps 2) and 3). we obtain 
a elosed'form solution of Fy. expressed in terms of y. ri (see (32). (33)) and v\ 
(see (34)). This solution is displayed in Table 2. thereby completing the pro* 
eedure. 

Given Fy. we thus obtain a closed-form solution of the performability ps for 
intervab of the form Bf = (b|b < y{, i.e.. 

Ps(By) = Fy(y). 

To get a clearer picture of what this solution looks like. Figs. 6 and 7 display 
plots of ps(B^) = Fy(y) as a function of y for various choices of t and the base 
model parameters. Fig. 6 considers the system where t s 240 (10 da3rs). 

u = ^ * 1.5. Xp = 10"®. Xh = 10~*. Cp = 0.999. pg = 0.9, pi = 0.09, and po = 0.01. 

The figure furnishes several plots showing how Fy(y) varies as L ranges from 0 to 
10 in steps of 2. Fig. 7 is similar to Fig. 6 except that pgs t.O (whence 


Pi s pq = 0), i.e.. the system is initially fault-free. 

Solutien with respect to an arbitrary measurable set B of accomplishment 
levels can then be formulated via integration (see [12], eqn. (9)). In practice, 
however, the sets B are typically intervals, in which case the performability 
values are provided directly by example, if one is interested in the 

system's ability to perform within speciiled limits bo and bi (bo<bi) then 
Bs(b|bo<b:<b|{, whence Ps(B)=FY(b|)-FY(bo). Another example, and one that 
arises even more frequently in practice, is the ability of the system to perform 
above a specified "performance threshold" bo. In this ease, Bs[b|b>bol ond 
P8(B)*l-Fy(bo). 

Jpplication of the soiution 

To illustrate an application of the dual-processor solution (Table 2), let us 
suppose the designer wants to maudmize the probability that the normalized 
average throughput rate exceeds a specified fraction bo. In other words, as dis- 
cussed above, the accomplishment set in question is Bs[b|b>bo) and we want to 
maximize the probability ps(B)=l— Fy(bo). Suppose further that the design 
choice is the value of the buffer capacity L, which is interesting since this choice 
can influence performance and reliability in a compensating manner. Were per- 
formance the only issue, then L should be made as large as possible (subject to 
other practical constraints such as cost) since the larger the buffer, the higher 
the normalized average throughput rate (see (21)). On the ether hand, if relia- 
bility were the only issue, then no buffer at all (L ~ 0) is the best choice since it 
will minimiz e the probability of system failure. Realistically, however, both per- 
formance and reliability are issues and. when considered simultaneously, we find 
that the performability (relative to a specified set B) can be optimized by an 
Appropriate choice of L. 

For example, suppose B = [b|b > 0.75], i.e.. the system S performs within B 
if the normalized average throughput rate is greater than 0.75. Then, for vari- 
ous choices of the buffer stage failure rate (the remaining parameter values 
are as in Fig. 7), the variation of ps(B) as a function of buffer capacity L is 
displayed in Fig. 6. In the case of a perfectly reliable buffer (X^ - 0). we note 
that performability is a monotonically increasing fuiustion of the buffer capacity 
L, as one would expect. On the other hand, when buffer stages f^ at a nonzero 
rate, we see that L can be chosen so as to maximize performability where, the 


higher the failure rate, the lower the optimum value of L. 

This is but one example of how such a closed-form solution of performability 
might be applied. Indeed, for the solution in question (Table 2), we have only 
begun to investigate its implications. Therefore, we intend to continue our 
exploration of various properties of this solution. We also want to investigate 
hew the modeling and solution techniques discussed herein might be extended 
so as to apply to a more genbral class of systems. 
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CAPTIONS 


Figure 1. Block diagram of C. 

Figure 2 . State-transition-rate diagram of 
Figure 3. State-transition-rate diagram of 
Figure 4. State-transition-rate diagram of Xc, 

Figure 5. C, for y in the range ris:y<r8. 

Figure 6. Plot of ps(B,) = Fy(y) as a function of y for the indicated choices of t 
and the base model parameters. 

Figure 7. Plot of ps(B,) = FY(y) as a function of y for the indicated choices of t 
and the base model parameters. 

Figures. ps(B) as a function of the buller capacity L. 

Table 1. . Base model parameters. 

Tables. Closed-form solution of F*. 
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Fig. 7. Plot of p^ (By)*Py (y) as a f 
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Table 1* Base model pareuneters. 







1) Oj< y < Xj^ 


Pv(y) • 1 - p. 


-V. 


-V. 


>2ty # -v^ty 

® ■’■ ®2''a *® “« 


(• 


1 


(Vj- v^) 


- Pj^e 


-v^ty 


2)r,< y < r. 


Py(y) • 1 “ P2 


-Vjty 


/ ( v2-Vj|.)tr2ly-ri) v 

I -Vjty (rj-r.) -v^yl 

+ ®2'^2\® ® ~® / 


(Vj- v^) 



